Privacy Policy of the QR‑CMS (QRTO) Service

Individual Entrepreneur Berdyugin A.E., Republic of Kazakhstan

This Privacy Policy (hereinafter referred to as the "Policy") regulates the procedure for processing and protecting the personal data of Users of the SaaS service QR‑CMS (QRTO) (hereinafter referred to as the "Service"), owned by IE Berdyugin A.E., IIN 780619301282, located at: 20 Amre Kashaubaev St., Ust‑Kamenogorsk, Republic of Kazakhstan (hereinafter referred to as the "Operator").

The Policy has been developed in accordance with the legislation of the Republic of Kazakhstan, including:

  • Law of the RK "On Personal Data and Their Protection"
  • Law of the RK "On Informatization"
  • Law of the RK "On Protection of Consumer Rights"
  • Civil Code of the RK

By using the Service, the User confirms that they have read and agree to this Policy.

1. Collected Data

The Operator collects only those data that are necessary for registration, providing access to the Service, and ensuring its correct operation.

1.1. Data Provided by the User

  • Name
  • Email
  • Phone number
  • Telegram login
  • Content uploaded to the Service (texts, images, menus, pages, etc.)

1.2. Technical Data

The Service automatically collects technical information:

  • IP address
  • browser and device type
  • data on pages visited
  • cookies (more details in the Cookie Policy)

1.3. Payment Data

Information about transactions transmitted by the payment provider Robokassa.

The Operator does not store bank card data.

2. Purposes of Personal Data Processing

Personal data are processed for:

  • registration and identification of the User;
  • providing access to the Service functionality;
  • fulfilling obligations under the Public Offer Agreement;
  • providing technical support;
  • sending notifications related to the operation of the Service;
  • improving the quality of the Service;
  • complying with the requirements of the legislation of the Republic of Kazakhstan.

3. Legal Grounds for Processing

The Operator processes data based on:

  • User consent;
  • the Public Offer Agreement;
  • requirements of the legislation of the RK;
  • the necessity for the functioning of the Service.

4. Data Processing and Storage Conditions

4.1. Data Storage Location

All data are stored on the servers of the TimeWeb hosting provider, located on the territory of the Republic of Kazakhstan.

4.2. Storage Period

Personal data are stored:

  • for an unlimited period as long as the account is active;
  • until the moment of account deletion by the User;
  • until the withdrawal of consent for data processing;
  • at the request of the User, data can be anonymized or completely deleted if this does not contradict the legislation.

5. Transfer of Data to Third Parties

The Operator may transfer data to third parties only in the following cases:

5.1. Payment Providers

Robokassa — for making payments.

5.2. Email Services

Brevo — for sending service notifications and emails.

5.3. Hosting Provider

TimeWeb — for ensuring the operation of the Service.

5.4. State Authorities

Only upon legal request.

The Operator does not sell and does not transfer personal data to third parties for commercial purposes.

6. Cookies and Analytics

The Service uses:

  • Yandex.Metrica
  • Google Analytics

These services may collect anonymized data on User behavior. More details in the Cookie Policy.

7. User Rights

The User has the right to:

  • receive information about the processing of their data;
  • request clarification, blocking, or deletion of data;
  • withdraw consent for processing;
  • restrict processing;
  • request data anonymization;
  • contact the authorized body for the protection of personal data of the RK.

8. Operator Obligations

The Operator undertakes to:

  • ensure the confidentiality of personal data;
  • use data only for the purposes specified in the Policy;
  • take measures to protect data;
  • notify the User about security breaches (if they occur);
  • terminate data processing at the request of the User, if possible by law.

9. Protection of Personal Data

The Operator applies:

  • data encryption;
  • secure transfer protocols;
  • access control;
  • backup;
  • security monitoring.

10. Deletion and Anonymization of Data

The User may request:

  • account deletion;
  • deletion of personal data;
  • data anonymization.

After deletion:

  • personal data are completely deleted;
  • technical data may be stored in anonymized form for statistics.

11. Changes to the Policy

The Operator has the right to change the Policy unilaterally. The new version comes into force from the moment of publication on the website.

Continued use of the Service means acceptance of the updated Policy.

12. Contact Information

For questions regarding the processing of personal data: legal@qrto.kz

13. Final Provisions

The Policy is governed by the legislation of the Republic of Kazakhstan. All disputes are resolved in accordance with the current legislation of the RK. The Policy is an mandatory part of the Public Offer Agreement.

Version: 2
Published at: 2026-03-24